mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-08 23:51:08 -09:00
3c8cfad804
Fixes the following vulnerability:
- CVE-2026-55199:
libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-
authentication denial of service vulnerability in the SSH_MSG_EXT_INFO
handler in src/packet.c that allows a malicious SSH server to cause a
client CPU exhaustion loop by sending a crafted extension count value.
A malicious server can set nr_extensions to 0xFFFFFFFF during key
exchange, causing the client to spin in a tight CPU loop for over 60
seconds because return values from _libssh2_get_string() are unchecked
and the session timeout does not apply to CPU-bound loops.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-55199
- 17626857d2
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
44 lines
1.7 KiB
Diff
44 lines
1.7 KiB
Diff
From 17626857d20b3c9a1addfa45979dadcee1cd84a4 Mon Sep 17 00:00:00 2001
|
|
From: TristanInSec <tristan.mtn@gmail.com>
|
|
Date: Wed, 15 Apr 2026 14:51:08 -0400
|
|
Subject: [PATCH] packet: check `_libssh2_get_string()` return in `EXT_INFO`
|
|
handler
|
|
|
|
The `SSH_MSG_EXT_INFO` handler discards the return values from
|
|
`_libssh2_get_string()` when parsing extension name/value pairs. When
|
|
the buffer is exhausted before all claimed extensions are parsed,
|
|
the loop continues with no-op iterations until `nr_extensions` reaches
|
|
zero.
|
|
|
|
The `nr_extensions >= 1024` cap limits the worst case, but the loop
|
|
should still break on parse failure for correctness and consistency
|
|
with other parsers in this file (e.g. `SSH_MSG_CHANNEL_OPEN`,
|
|
`SSH_MSG_KEXINIT`) that check `_libssh2_get_string()` return values.
|
|
|
|
Closes #1864
|
|
|
|
CVE: CVE-2026-55199
|
|
Upstream: https://github.com/libssh2/libssh2/commit/17626857d20b3c9a1addfa45979dadcee1cd84a4
|
|
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
|
|
---
|
|
src/packet.c | 6 ++++--
|
|
1 file changed, 4 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/src/packet.c b/src/packet.c
|
|
index ae86365d2a..8a7a0d2690 100644
|
|
--- a/src/packet.c
|
|
+++ b/src/packet.c
|
|
@@ -868,8 +868,10 @@ _libssh2_packet_add(LIBSSH2_SESSION * session, unsigned char *data,
|
|
|
|
nr_extensions -= 1;
|
|
|
|
- _libssh2_get_string(&buf, &name, &name_len);
|
|
- _libssh2_get_string(&buf, &value, &value_len);
|
|
+ if(_libssh2_get_string(&buf, &name, &name_len))
|
|
+ break;
|
|
+ if(_libssh2_get_string(&buf, &value, &value_len))
|
|
+ break;
|
|
|
|
if(name && value) {
|
|
_libssh2_debug((session,
|